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Abstract 

Quantum key distribution over probabilistic quantum repeaters is addressed. We compare, under 
practical assumptions, two such schemes in terms of their secure key generation rates per quantum 
memory. The two schemes under investigation are the one proposed by Duan et al. in [Nat. 414, 
413 (2001)] and that of Sangouard et al. in [Phys. Rev. A 76, 050301 (2007)]. We consider 
various sources of imperfection in both protocols, such as nonzero double-photon probabilities 
at the sources, dark counts in detectors, and inefficiencies in the channel, photodetectors and 
memories. We also consider memory decay and dephasing processes in our analysis. For the latter 
system, we determine the maximum value of the double-photon probability beyond which secret- 
key distillation is not possible. We also find the crossover distance beyond which the repeater 
schemes outperform the non-repeater ones. We finally compare the two protocols in terms of their 
achievable secret key generation rates at their optimal settings. 
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I. INTRODUCTION 



Despite all practical progress with quantum key distribution (QKD) jl-4|, its implemen- 
tation over long distances remains to be a daunting task. In conventional QKD protocols 
such as BB84 [5j, channel loss and detector noises set an upper bound on the achievable 
security distance 6| . In addition, the path loss results in an exponential decay of the secret 
key generation rate with distance. Both these issues can, in principle, be overcome if one 
implements entanglement-based QKD protocols (?], 0] over quantum repeater systems (IJ- 



12J. This approach, however, is not without its own challenges. Quantum repeaters require 
quantum memory (QM) units that can interact with light and can store their states for suf- 
ficiently long times. Moreover, highly efficient quantum gates might be needed to perform 
two-qubit operations on these QMs |9|]. The latter issue has been alleviated, to some extent, 
by introducing a novel technique by Duan, Lukin, Cirac and Zoller (DLCZ) [h]], in which 
initial entanglement distribution and swapping, thereafter, rely on probabilistic linear-optic 
operations. Since its introduction, the DLCZ idea has been extended and a number of new 



proposals have emerged 
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— Il8j] . Such probabilistic schemes for quantum repeaters particu- 
larly find applications in QKD systems of mid-to-long distances, which makes them worthy 
of analytical scrutiny. This papers compares DLCZ with one of its favorite successors, 



171 ]. which relies on single photon sources (termed SPS, hereafter). By considering various 
sources of imperfections in both systems, we provide a realistic account of their performance 
in terms of their secret key generation rates per logical memory used. This measure not 
only quantifies performance, but it also accounts for possible costs of implementation. 

The SPS protocol attempts to resolve one of the key drawbacks in the original DLCZ 
protocol: multi-photon emissions. DLCZ uses atomic ensembles as QMs, which lend them- 
selves to multi-photon emissions. This leads to obtaining not-fully-entangled states, hence 
resulting in lower key rates when used for QKD. To tackle this issue, in the SPS protocol, 
entanglement is distributed by ideally generating single photons, which will either be stored 
in QMs, or directed toward a measurement site. Whereas, in principle, the SPS protocol 
should not deal with the multi-photon problem, in practice, it is challenging to build on- 
demand single photon sources that do not produce any multi-photon components. A fair 
comparison between the two systems is only possible when one considers different sources 
of non-idealities in both cases, as we will pursue in this paper. 



The SPS protocol is one of the many proposed schemes for probabilistic quantum re- 



peaters. In 18], authors provide a review of all such schemes and compare them in terms 
of the average time that it takes to generate entangled states, of a certain fidelity, between 
two remote memories. Their conclusion is that in the limit of highly efficient memories and 
detectors, the top three protocol are the SPS protocol and two others that rely on entan- 
gled/two photon sources [if]]. In more practical regimes, however, the SPS protocol 
seems to have the best performance per memory/mode used. In this paper, we therefore 
focus on the SPS protocol, and will investigate, under practical assumptions, whether the 
above conclusion remains valid in the context of QKD systems. 

Our work is distinct from previous related work in its choice of the figure of merit used for 
comparison. In [18|, authors have adopted the general measure of fidelity to find the average 
time of entanglement generation. Whereas that approach provides us with a general insight 
into how each system performs, it cannot be directly applied to the case of QKD. Here, we 
adopt the secret-key generation rate per memory as the main figure of merit, by which we 
can specify the optimal setting of the system and its performance in different regimes of 
operation. 

Another key feature of our work is to use a normalized figure of merit to compare the 
DLCZ and SPS protocols. In practice, to obtain a sufficiently large key rate in such prob- 
abilistic systems, one must use multiple memories and/or modes in parallel. In order to 
account for the cost of the system, in our analysis, we provide a normalized key rate per 
memory and/or mode. We calculate the dependence of the secret key generation rate on dif- 
ferent system parameters when resolving or non-resolving detectors are used. In particular, 
we find the optimal values for relevant system parameters if loss, double-photon emissions 
and dark counts are considered. Moreover, we account for the dephasing and the decay of 
memories in our analysis. 

The paper is structured as follows. In Sec. II, we review the DLCZ and the SPS protocols, 
their entanglement distribution and swapping schemes, as well as their QKD measurements. 
In Sec. Ill, we present our methodology for calculating the secret key generation rate for 
the SPS protocol, followed by numerical results in Sec. IV. We draw our conclusions in Sec. 
V. 
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II. TWO PROBABILISTIC SCHEMES FOR QUANTUM REPEATERS 



In this section we will review two probabilistic schemes, namely, DLCZ and SPS, for 
quantum repeaters. We describe the multiple-memory setup for such systems and model 
relevant system components. 



A. DLCZ entanglement-distribution scheme 

The DLCZ scheme works as follows; see Fig. QJa). Ensemble memories A and B, at 
distance L, are made of atoms with A-level configurations. They are all initially in their 
ground states. By coherently pumping these atoms, some of them may undergo off-resonant 
Raman transitions that produce Stokes photons. The resulting photons are sent toward a 
50:50 beam splitter located at distance L/2 between A and B. If, ideally, only one photon 
has been produced in total at the ensembles, one and, at most, only one of the detectors in 
Fig. [TJa) clicks. In such a case, the DLCZ protocol heralds A and B to be ideally in one of 
the Bell state \ip±) AB = (\10) ab ± |01)ab) /v2, where |0)j is the ensemble ground state and 
|l)j = Sj\0)j is the symmetric collective excited state of ensemble J = A, B, where Sj is 



the corresponding creation operator 10] . An important feature of such collective excitations 



is that they can be read out by converting their states into photonic states. 

The fundamental source of error in the DLCZ scheme is the multiple-excitation effect, 
where more than one Stokes photon are produced fll ]. If the probability of generating 
one Stokes photon is denoted by p c , there is a probability p\ that each ensemble emits one 
photon. If this happens, a click on one of the two detectors heralds entanglement generation, 
whereas the memories are in the separable state |11)ab- 

In practice, one has to find the right balance between the heralding probability, which 
increases with p c , and the quantum bit error rate (QBER), which also increases with p c . In 



HI], authors find the optimal value of p c that maximizes the secret key generation rate in 
various scenarios when photon-number resolving detectors (PNRDs) or non-resolving photon 
detectors (NRPDs) are used. In this paper, we use their results in our comparative study. 




pump 
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FIG. 1. (Color online) Schematic diagram for entanglement distribution between quantum memories (QMs) 
A and B for (a) the DLCZ protocol and (b) the SPS protocol. In both cases, we assume QMs can store 
multiple excitations. Sources, memories and detectors are represented by circles, squares and half-circles, 
respectively. Vertical bars denote beam splitters. In both protocols the detection of a single photon ideally 
projects the two memories onto an entangled state. 

B. SPS entanglement-distribution scheme 

The SPS protocol, proposed in [T3], aims at reducing multi-photon errors and, in par- 
ticular, terms of the form |11)ab by using single-photon sources. The architecture of this 
scheme is presented in Fig. HJb). The two remote parties each have one single-photon source 
and one memory. In the ideal scenario, each source produces exactly one photon on demand, 
and these photons are sent through identical beam splitters with transmission coefficients rj. 
It can be shown that the state shared by the QMs after a single click on one of the detectors 

n 

in Fig. H](b) is given by |17[ 



v\00)ab(00\ + {1-t]) \ij ± ) AB (V±|, 



(1) 



which has our desired entangled state plus a vacuum component. The latter, at the price 
of reducing the rate, can be selected out once the above state is measured at later stages 

id, y. 

In a practical setup, several sources of imperfection must be considered in Fig. [T](b). 
First, most known techniques for generating single photons suffer from multiple-photon 




FIG. 2. (Color online) (a) Entanglement connection between two entangled links A- A' and B'-B. The 
memories A 1 and B' are read out and the resulting photons are combined on a 50:50 beam splitter. A click 
on one of the detectors projects A and B into an entangled state. The retrieval efficiencies and quantum 
efficiencies are represented by fictitious beam splitters with transmission coefficient r\ c and r/jj, respectively, 
(b) The equivalent butterfly transformation to the measurement module, where 77,, = r\ c r\D. 



emissions. That includes single-photon sources that r ely on parametric down-conversion 
0,0]; quasi-atomic structures such as quantum dots 21], or the partial memory-readout 



technique described in [18j . In all cases, there is a nonzero probability to generate more than 
one photon, which manifests itself in producing nonzero values for second-order coherence 
functions [2c]]. For practical purposes, however, it is often sufficient to consider the effect 
of two-photon states, as we will do, in this paper. It turns out that this approximation is 
particularly valid for the systems of interest in this paper. One should also consider non- 
idealities in QMs. In our analysis, we account for reading and writing efficiencies of QMs, 
as well as their decay and dephasing processes. We assume that QMs can store multiple 
excitations. 

Throughout the paper, we assume that both setups in Fig. CD are symmetric and phase 
stabilized. Furthermore, all conditions required for a proper quantum interference at 50-50 
beam splitters are assumed to be met. Recent experimental progress in QKD shows that it 



is indeed possible to achieve these conditions 



22 



23|. 



C. Entanglement swapping and QKD measurements 

Figure [2](a) shows the entanglement swapping setup for the DLCZ and the SPS protocols. 
Entanglement is established between QM pairs AA' and B'B using either of protocols. 
A partial Bell-state measurement (BSM) on photons retrieved from the middle QMs A' 
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FIG. 3. (Color online) QKD measurements on two entangled pairs. Two pairs of memories, A-B and C-D, 
each share an entangled state. Memories are read out and the resulting photons are combined at a beam 
splitter and then detected. Different QKD measurements can be performed by choosing different phase shift 
values, ip, of and tt/2. 



and B' is then followed, which upon success, leaves A and B entangled. The BSM is 
effectively performed by a 50:50 beam splitter and single-photon detectors. To include 
the effects of the atomic-to-photonic conversion efficiency and the photodetectors' quantum 
efficiency, we introduce two fictitious beam splitters with transmission coefficients rj c and 
r}E>, respectively. All photodetctors in Fig. [2] will then have unity quantum efficiencies. Note 
that the parameter rj c also includes the memory decay during the storage time. 

Figure [2]^b) provides a simplified model for the measurement module in Fig. |2{a). The 
50:50 beam splitter and the two fictitious beam splitters in Fig. EJ^b) constitute what we 
call a butterfly operation, which will be further studied in Sec. [TTT] and Appendix [A] 

Alice and Bob use two butterfly operations to generate a raw key bit, as shown in Fig. [3J 
After generating entangled pairs over a distance L, Alice and Bob retrieve the states of 
memories and perform a QKD measurement on the resulting photons. They apply a random 
relative phase shift, (p, of either or ir/2, between their two fields. They will later, at the 
sifting stage, only keep data points where the same phase value is used by both parties. 
They then turn their sifted keys into a secure key by using privacy amplification and error 
reconciliation techniques. Eavesdroppers can be detected by following the BBM92 or the 
Ekert protocol QQ- 

As mentioned in Sec. HJ previous analyses on ly p rovide the fidelity or the time required 



for a successful creation of an entangled state [13] ■ Instead, in Sec. IHIl we will calculate 



the secret key generation rate for the SPS scheme and compare it with that of the DLCZ 



protocol reported in 
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FIG. 4. (Color online) (a) A quantum repeater with multiple quantum memories per node. At each round, 
we employ entanglement distribution protocol to entangle any unentangled memory pairs over shortest links. 
At any such cycle, we also match up entangled pairs at different stations to perform Bell-state measurements 
(BSMs). (b) A quantum repeater with multimode memories. In each round, we apply our entanglement 
distribution scheme on all M modes, until one of them becomes entangled. BSM will be followed as soon as 
entanglement is established on both sides. 

D. Multiple-memory configuration 

In order to compare different quantum repeater setups, we consider the multi ple- memory 
configuration shown in Fig. Ufa) along with the cyclic protocol described in 25|, |26| . In this 
protocol, in every cycle of duration Lq/c, where L is the length of the shortest segment 
in a quantum repeater, and c is the speed of light in the channel, we try to entangle any 
unentangled pairs of memories at distance Lq. We assume our entanglement-distribution 
protocol succeeds with probability Ps {Lq). At each cycle, we also perform as many BSMs 
as possible at the intermediate nodes. The main requirement for such a protocol is that, at 
the stations that we perform BSMs, we must be aware of establishment of entanglement over 
links of length 1/2 before extending it to / (informed BSMs). We use the results of 25j to 
calculate the generation rate of entangled states per memory in the limit of infinitely many 



memories. It is given by R CQt (L) = P s (L/2 n ) P$P$...P]£ > / (2L/c) , where P 



>(«) 



>(0 

M i 



1...71, 



is the BSM success probability at nesting level i for a quantum repeater with n nesting 
levels. 

We use the following procedure, in forthcoming sections, to find the secret key generation 
rate of the setup in Fig. Ufa). For each entanglement distribution scheme, we find Ps (Lq) 
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and relevant Pm probabilities to derive _R e nt (L) . We then find the sifted key generation rate 
by multiplying i? ent (L) by the probability, P c u c k, that an acceptable click pattern occurs 
upon QKD measurements. Finally, the ratio between the number of secure bits and the 



sifted key bits is calculated using the Shor-Preskill lower bound 



27| . In the limit of an 



infinitely long key, the secret key generation rate per logical memory is lower bounded by 

R QKD (L) = max( J R cnt (L) P chck [1 - 2 H (e Q )] , 0), (2) 
where €q denotes the QBER, and H(p) = —p\og 2 p — (1 — p) log 2 (l — p), for < p < 1. 



E. Multimode-memory configuration 

Another way to speed up the entanglement generation rate is via using multimode mem- 



ories 



15 



]. As can be seen in Fig. 11(b), in this setup, we only use one physical memory 
per node but each memory is capable of storing multiple modes. In each round, we attempt 
to entangle memories at distance L by entangling, at least, one of the existing M modes. 
Once this occurs, we stop entanglement generation on that leg and wait until a BSM can 
be performed. For readout, all modes must be retrieved in order to perform BSMs or QKD 
measurements on particular modes of interest. In effect, this scheme is similar to that of 
Fig. IUa), except that entanglement distribution is not sequentially applied to unentangled 
modes. The success probability for entanglement distribution between the two memories is, 
however, M times that of Fig. H(a). One can show that, the generation rate of entangled 
states per mode is approximately given by (|) R ent (L) [18|, |26 |. 

In our forthcoming analysis, we only consider the case of Fig. IU(a), but our results are 
extensible to the case of Fig. 11(b) by accounting for the relevant prefactor. 



F. Memory decay and dephasing 

Quantum memories are expected to decay and dephase while storing quantum states. 
In this paper, we model these two processes independently. The decay process, with a 
time constant Ti, can be absorbed in the retrieval efficiency of memories. If the retrieval 
efficiency immediately after writing into the memory is given by rjo, after a storage time T, 
the retrieval efficiency is given by r] c = i] exp(—T/Ti). Different memories in the multiple- 
memory setup of Fig. H](a) undergo different decay times. In our analysis, we consider the 
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worst case scenario where all memories have decayed for T = L/c, which is only applicable 
to the far-end memories. Under this assumption, r\ c can be treated as a constant at all stages 
of entanglement swapping. 

We model the memory dephasing via a dephasing channel, by which the probability 
of dephasing after a period T is given by = [1 — exp(— T/T 2 )]/2. In the context of 
the QKD protocol in Fig. [3J this phase error is equivalent to the misalignment error in 
a conventional polarization-based BB84 protocol and has mostly the same effect. In our 
analysis, we neglect the effect of dephasing at the middle stages, and only consider its effect 
on the far-end memories used for the QKD protocol. Again, for the multiple-memory setup 
of Fig. 11(a), the relevant storage time is given by T = L/c 25]. 



III. SPS SECRET KEY GENERATION RATE 

In this section, the secure key generation rate for the SPS scheme proposed in [17[ is 
calculated. As was shown in section II, this scheme relies on simultaneous generation of 
single photons in two remote sites. Most practical schemes for the generation of single 
photons, however, suffer from the possibility of multiple-photon emissions. To address this 
issue, in this section, we consider non-ideal photon sources with nonzero probabilities for 
two-photon emissions, and find the secret key generation rate in the repeater and no-repeater 
cases. 

Suppose our photon sources emit one photon with probability 1—p and two photons with 
probability p. We, therefore, have the following input density matrix for the initial state of 
I and r sources in Fig. [5(a) 

pS; n) = pl ir W n) , (3) 



where 



pf^a-p) |l> ii <l|+p|2) ii <2| , j = l,r. (4) 



As we will show later, in a practical regime of operation, p < 1; hence, in our following 
analysis, we neglect O (p 2 ) terms corresponding to the simultaneous emission of two photons 
by both sources. 
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FIG. 5. (Color online) A schematic model for the SPS scheme. In (a) the memories' writing efficiencies, 
the path loss and the detectors' efficiencies are represented by fictitious beam splitters with transmission 
coefficients rj m , r\ t and r]o, respectively. In (b), an equivalent model is represented, where we have grouped 
beam splitters in the form of butterfly modules; see Fig. [5] . Here, rj t rjo = r\ m r\d and the model is valid so 
long as r\ t r\d ^ r) m . 




FIG. 6. (Color online) A generic butterfly module, represented by B^ flflil where t\b and r\ x are transmis- 
sivities for beam splitters shown in the figure. 

A. No-repeater case 

In this section, we describe how we obtain parameters Ps, P c \ick, and -Rqkd for the setup 
in Fig. GD^a) and QKD measurements as in Fig. [3j 

Figure [5]^a) depicts the entanglement-distribution setup for the SPS scheme. In our model 
the memories' writing efficiencies, the path loss and the detectors' efficiencies are represented 
by fictitious beam splitters with transmission coefficients r] m , rj t and r)o, respectively, where 
r] t = exp[— L/(2L att )} with L att = 25 km for an optical fiber channel. Photodetectors, in 
Fig. [5j are then assumed to have unity quantum efficiencies. 

In our analysis, we use an equivalent setup, as shown in Fig. MP), where beam splitters 
have been rearranged such that r] t ri£, = 1]^^. We can then recognize similar building blocks, 
which we referred to by butterfly modules, in Fig. [5](b). A butterfly module, as shown in 

II 



Fig. |6l is a two-input two-output building block consisting of three beam splitters. For an 
input state pyR> in Fig. |6l we denote the output state on ports L and R by B nBtVx (pl'r') ■ 



We use well-known models for beam splitters [29] to find output density matrices for 
input states to a generic butterfly module. In Appendix A, we find the relevant input- 
output relationships for the states of interest. We use Maple 15 to simplify some of our 
analytical results. We can then find, palbr, the joint state of the memories and the optical 
modes entering detectors L and R in Fig. [5](b) by applying the butterfly operation three 
times, as follows 

Palbr = B 0Ava (\„ m (pf n) ) ® B rmm ( P C*0)) . ( 5 ) 

According to the SPS protocol, a click on exactly one of the detectors L or R, in Fig. E^b), 
would herald the success of entanglement distribution. This process can be modeled by 
applying proper measurement operators considering whether PNRDs or NRPDs are used. 
For example, for a click on detector L, the explicit form of the measurement operator is 
given by 

(i-4)[|i)ll(i|®|0)^(0| + 

410)^(01(8)10)^(01], PNRD 



M 



(6) 

;1-4)[(/l-|0)ll(0|) ®|0>*h(0| + 

4|0) LL (0|® |0)^(0|], NRPD 



where II denotes the identity operator for the mode entering the left detector [30j], and d c 
is the dark-count rate per gate width per detector. 

After the measurement, the resulting joint state, pab, of quantum memories is given by: 

tr L ,R (palbrM) 

PAB = p , (7) 



where 



P = tr (palbrM) = (8) 



is the probability that the conditioning event M occurs. The last equality is due to the 
symmetry assumption. 

For QKD measurements, we assume two pairs of memories, A-B and C-D, are given in 
an initial state similar to that of Eq. (|7|). We use the scheme described in Fig. E]to perform 
QKD measurements. For simplicity, we assume both users use zero phase shifts; other cases 
can be similarly worked out in our symmetric setup. In Fig. [31 the retrieval efficiency and the 
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quantum detectors efficiency are represented by fictitious beam splitters with, respectively, 
transmission coefficient rj c and t)d. It is again possible to remodel the setup in Fig. [3] as 
shown in Fig. |2fb), and use the butterfly operation B 05iVs , where rj s = r\ c r\ D . The density 
matrix right before photodetection in Fig. [3] is then given by B 05ria (B 05jVs (pab <E> Pcd)) , 
where one of the 5-operators is applied to modes A and C, and the other one to modes B 
and D. Using this state, we find P c ii C k and €q as outlined in Appendix B. 

Using Eq. (j2J), the secure key generation rate per memory, -Rqkd, in the no-repeater setup, 



is then lower bounded by [11] : 



Ri = max 



2H(e Q ))^-P chck /2,0 



(9) 



P (L) 

where ; — , given by Eq. (JSJ), is the generation rate of entangled pairs per logical memory 

2L/c 

-Pciick is the probability of creating a sifted key bit by using two entangled pairs, and [1 — 
2H(eq)\ is the probability of creating a secure key bit out of each sifted key bit. Here, we 



assume a biased basis choice to avoid an extra factor of two reduction in the rate 
full definition for P c ii C k is given by Eq. ( 1B3|) . The QBER, 



3l|. The 



P 

1 error 

£q = (10) 

-'click 

where P e rror is the probability that Alice and Bob assign different bits to their sifted keys, 
is given by Eq. flB4p . 



B. One- node repeater case 

In this section, we consider a repeater setup with nesting level one, as shown in Fig. Ufa). 
We use the structure of Fig. Ef a) to distribute entanglement between A- A' and B'-B mem- 
ories. The initial joint state of the system, paa'bb' = Paa' <S> Pbb 1 , can then be found, using 
Eq. ([70, as described in the previous section. We then apply a BSM by reading memories 
A' and B' and interfering the resulting optical modes at a 50:50 beam splitter. Success is 
declared if exactly one of the detectors in Fig. [21(a) clicks. This can be modeled by applying 
measurement operators in Eq. ([6]), which results in 

ti LR (Mp' ALBR ) 
Pab = = , (11) 
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Memory writing efficiency, rj m 


0.5 


Quantum efficiency, t]d 


0.3 


Memory retrieval efficiency, rj c 


0.7 


Dark count per pulse, d c 


10" 6 


Attenuation length, L att 


25 km 


Speed of light, c 


2 • 10 5 km/s 


Decay (dephasing) time constants, T\ (T2) 


00 



TABLE I. Nominal values used in our numerical results. 



where p'albr = Bo.5,r) s (paa'bb 1 ), where L and R represent the input modes to the photode- 
tectors. Note that, in Fig. [2j the detectors have ideal unity quantum efficiencies. Moreover, 

P L = tr {Mp' ALBR ) = P M /2 (12) 

is the probability that only the left detector clicks in the BSM module of Fig. [2j A click on 
the right detector has the same probability by symmetry. 

In order to find the secret key generation rate, we will follow similar steps to the no- 
repeater case. That is, we apply the butterfly operation to find relevant density matrices, 
from which P c n c k and €q can be obtained. From Eq. (T2]), in the one-node repeater case, 
-Rqkd is lower bounded by 

(13) 

IV. NUMERICAL RESULTS 

In this section, we present numerical results for the secret key generation rate of the SPS 
protocol, versus different system parameters, in the no-repeater and the one-node repeater 
cases, and we compare them with that of the DLCZ protocol. As mentioned earlier, we 
have used Maple 15 to analytically derive expressions for Eqs. and (1131) when PNRDs or 
NRPDs are used. Unless otherwise noted, we use the nominal values summarized in Table 
U for all the results presented in this section. 
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FIG. 7. (Color online) -Rqkd versus the source transmission coefficient n for the PNRDs and NRPDs in 
the no-repeater and one-node repeater cases. Here, p = 0.001 and L = 250 km; other parameters are listed 
in Table U 

A. SPS key rate versus system parameters 

1. Source transmission coefficient 

Figure [7J shows the secret key generation rate per memory, -Rqkd, versus the source 
transmission coefficient rj in Fig.[T](b), at p — 0.001 and L = 250 km. It can be seen that there 
exist optimal values of 77 for both repeater and no-repeater systems. Table [Til summarizes 
these optimum values in different cases. The optimal value of r\ for the no-repeater system is 
higher than the repeater one, and that is because of the additional entanglement swapping 
step in the latter system. Another remarkable feature in Fig. [7J is that the penalty of using 
NRPDs, versus PNRDs, seems to be minor at p = 10~ 3 . PNRDs better show their advantage 
at higher values of p when double-photon terms become more evident. 

The existence of an optimal value for rj arises from a competition between the probability 
of entanglement distribution P$, which grows with rj, and P c iick, which decreases with 77. 
This has been demonstrated in the inset of Fig. [7J The latter issue is mainly because of the 
vacuum component in Eq. ([1]). In the case of the repeater system, Pm also decreases with 77 
for the same reason, and that is why the optimal value of rj is lower for repeater systems. 

The optimum values of r] in Fig. [7J are interestingly almost identical to the value of rj that 
minimizes the total time for a successful creation of an entangled state, as prescribed in . 
It is because, at a fixed distance, the QBER term in Eqs. (Q and (fl3l) is mainly a function 
of the double-photon probability and the dark count rate, and it does not considerably vary 
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PNRD 


NRPD 


No repeater 


0.35 


0.34 


One-node repeater 


0.28 


0.27 



TABLE II. Optimal values of r), at p = 0.001 and L = 250 km, for repeater and no-repeater systems, when 
PNRDs or NRPDs are used. 




350 400 450 

Distance, L (km) 



FIG. 8. (Color online) (a) The optimum value of the source transmission coefficient r\ in the no-repeater 
and repeater cases versus distance. All other parameters are as in Table [IJ (b) -Rqkd versus distance, using 
values listed in Tables III and ITT1 The dark count imposes a shorter security distance on the no-repeater system 
than the repeater one. 



with 7]. 

More generally, the optimum values of r\ remain constant as in Table [TT] so long as the error 
terms are well below the cut-off threshold in QKD. This effect has been shown in Fig. El^a), 
where the optimum value of 77, in the case of NRPDs, is depicted versus distance. It can be 
seen that up until around 400 km, for the no-repeater system, and 600 km, for the repeater 
system, the optimum value of 77 is fixed. At these points, however, which correspond to 
the security distances in each case, see Fig. [8](b), the optimal values start rising. This is 
to combat the effect of dark counts, which has now become significant at long distances, 
and in effect to reduce the QBER. The same behavior is observed if one changes the dark 
count rate or the double-photon probability. That is, optimal 77 is fixed until the error terms 
become significant, at which point higher values of 77 are favored. Unless otherwise noted, 
we use the optimum values of rj as listed in Table [III in all forthcoming graphs. 
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FIG. 9. (Color online) (a) -Rqkd versus the double-photon probability p using PNRDs and NRPDs in the 
no-repeater and repeater cases, (b) Cutoff double-photon probability, at which the key rate becomes zero, 
versus the dark count rate d c . The higher the dark count rate, the less room for multi-photon errors. All 
graphs are at L = 250 km. 

2. Double-photon probability 

Figures M show the secret key generation rate for the SPS protocol, at the optimal values 
of r) listed in Table HTl versus the double-photon probability p in the no-repeater and repeater 
cases. It can be seen that, in both cases, there exists a cutoff probability at which -Rqkd 
becomes zero. This point corresponds to the threshold QBER of 11% from the Shor-Preskill 
security proof. In the case of QMs with sufficiently long coherence times, as is the case in 
Fig. [91 the QBER in our system stems from two factors: dark count and double-photon 
probability. The former is proportional to d c j rjd and it comes into effect only when the path 
loss is significant. The latter, however, affects the QBER at all distances. To better see 
this issue, in Fig. Mjo), the cutoff probability is depicted versus the dark count rate. It can 
be seen that the cutoff probability linearly goes down with d c , which confirms the additive 
contribution of dark count and two-photon emissions to the QBER. 

The cutoff probability at d c = deserves a particular attention. As can be seen in 
Fig. [2(b), for the no-repeater system, the maximum allowed value of p is about 0.028 for 
PNRDs and 0.026 for NRPDs. This implies that the QBER in this case, at d c = 0, is 
roughly given by 4p. This can be verified by finding the contributions from two- and single- 
photon components in Eq. (j4j). We can then show that the QBER, at the optimal value 
of r) in Table [Til is roughly given by 3(1 + rf)p « Ap. Similarly, in the repeater case, one 
can show that each BSM almost doubles the contribution of two-photon emissions to the 
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FIG. 10. (Color online) The crossover distance, at which repeaters outperform non-repeater systems, as a 
function of (a) the double-photon probability p for different values of memory writing efficiency, 7y m , and 
(b) the measurement efficiency rj s — r) c r\D. All other parameters are taken from Tables HI and HT1 

QBER. Considering that four pairs of entangled states is now needed, and that the chance 
of making an error for an unentangled pair is typically 1/2, the QBER is roughly given by 
4 x 2 x 3(l + i])p/2 ps 16p, which implies that, to the first-order approximation, the maximum 
allowed value for p is about 0.11/16 = 0.0068. Figure [9]( a) confirms this result, where the 
cutoff probability is about 0.0056 for the PNRDs and 0.0054 for the NRPDs, corresponding 
to e Q ps 20p. 

With a similar argument as above, one may roughly expect a factor of 4-to-5 increase in 
the QBER for each additional nesting level. This implies that for a repeater system with 
nesting level 3, we should expect a QBER around 500p just because of the double-photon 
emission. We discuss the practical implications of this finding later in this section. 

3. Crossover distance 

It is a matter of architectural importance to find the crossover distance — the distance be- 
yond which the repeater setup outperforms the direct link — for the SPS protocol. Figure flOl 
shows the crossover distance versus different parameters. As we showed in the previous sub- 
section, by increasing p the QBER would increase more in the repeater system than in the 
no-repeater one. That would manifest itself in an increasing crossover distance, as shown in 
Fig. fTDT a). with p. The crossover distance will, however, decrease if component efficiencies 
go up. This has been shown in Fig. fTDTa) for r\ m and in Fig. fTOT b) for the measurement 
efficiency The latter directly impacts the BSM success probability, P M , and that is why 
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the larger its value the better for the repeater system. Larger values of rj m also reduce the 
vacuum component, thus enhancing the chance of success at the entanglement swapping 
stage. 

Even for highly efficient devices, according to Fig. fTOT b). the crossover distance would 
tend to lie at around 250-350 km, which implies that the distance between two nodes of a 
repeater system is somewhere around 125-175 km. This could be a long distance for practical 
purposes, such as for phase stabilization, and that might require us to work at a suboptimal 
distancing. The latter would further reduce the secret key generation rate. It is, however, 
expected that by movin g up to higher nesting levels, the optimum distancing would decrease 



at higher distances [18|, |26 |. 



4- Memory dephasing 

Figure ITHT a) shows the secret key generation rate per memory for the SPS protocol with 
NRPDs versus distance for two different values of the decoherence time, T 2 , at p = 10~ 3 . It is 
clear that, by reducing the coherence time, the security distance drops to shorter distances. 
Whereas, at T 2 = 100 ms, the key rate remains the same as that of Fig. [8]^b), at T 2 = 10 ms, 
both repeater and non-repeater systems would fall short of supporting distances over 360 km. 

Figure [TTT b) shows the secret key generation rate per memory versus T 2 at L = 250 km. 
There is a minimum required coherence time of around 5 ms below which we can not exchange 
a secure key. This point corresponds to the 11% QBER mainly caused by the dephasing 
process. In fact, at this point, we have eg ~ = (1— exp[— Lj (cT 2 )])/2 = 0.11, which implies 
that the maximum distance supported by our protocol is about cT 2 /4. To be operating on 
the flat region in the curves shown in Fig. [TTTb). one even requires a higher coherence time. 
In other words, the minimum required coherence time to support a link of length L is on the 
order of lOL/c. This is in line with findings in j^J. Although not explicitly shown here, the 
same requirements are expected to be as well applicable to other QKD systems that rely on 
quantum repeaters. 
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FIG. 11. (Color online) (a) The secret key generation rate versus distance for two values of decoherence 



time, T2 = 10 ms and 100 ms. In (b) the secret key rate is plotted as a function of T2 at L = 250 km. 
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FIG. 12. (Color online) Comparison between the DLCZ and SPS protocols using PNRDs. For both systems, 
the better of repeater or non-repeater system is used. Both systems operate at their optimal setting: For 
the SPS protocol, the optimum value of 77 is used; for the DLCZ protocol, the optimum value of p c is used. 
By varying the double-photon probability, p, in the SPS protocol, we find that the maximum p at which 
SPS outperforms DLCZ is around p = 0.004. In all curves, d c = 0. All other parameters are taken from 
Tables U and HI 



B. SPS versus DLCZ 



Figure [12] compares the secret key generation rate for the SPS protocol, found in this 



paper, with that of the DLCZ protocol as obtained in In both systems, we have 

assumed d c = 0. All other parameters are as in Table HI In both systems, we use the optimal 
setting in the PNRD case. The conclusion would be similar if one uses NRPDs, as seen 
in all numerical results presented in this paper. For the SPS protocol, the optimal setting 
corresponds to the values of r\ in Table HT1 In the DLCZ protocol, the adjustable parameter 
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is the excitation probability p c . Note that, whereas in the SPS protocol, the rate decreases 
monotonically with p, in the DLCZ protocol, it peaks at a certain value of p c . That is 
because, in the SPS protocol, we use an on-demand source of photons, whereas in the DLCZ 
protocol, the heralding probability as well as the relative double-photon probability are both 
proportional to p c . The optimum value for the excitation probability is given by p c = 0.0243 
in the no-repeater case and p c = 0.0060 in the repeater case Note that the analysis in 



ll| accounts for all multi-excitation components in the initial state of the system. In all 



curves in Fig. [121 we have used the better of the repeater and no repeater systems at each 
distance. Our results show that the SPS protocol offers a higher key rate per memory than 
the DLCZ for on-demand single-photon sources with double-photon probabilities of 0.004 
or lower. The advantage is however below one order of magnitude in most cases. 



A key assumption in the results obtained above is the use of on-demand sources in the 
SPS protocol. The less-than one-order-of-magnitude difference between the two protocols 
can then be easily washed away if one uses single-photon sources with less than roughly 
50% efficiencies. This means that the conventional methods for generating single photons, 
such as parametric downconversion or quantum dots, may not yet be at a maturity level 
to be used in the SPS protocol. The partial memory-readout technique could, still, be a 
viable solution. In this scheme, we drive a Raman transition, as in the DLCZ protocol, in 
an atomic ensemble, such that with some probability p a Stokes photon is released. If we 
detect such a photon, then we are left with an ensemble, which can be partially read out 
with probability rj to resemble the first part of the SPS protocol. One should, however, note 
that with limitations on the cutoff probability to be on the order of 10 -4 -10 -5 , it may take 
quite a long time to prepare such a source-memory pair. For instance, if the required p is 
10~ 4 , and the efficiency of the collection and detection setup is 0.1, even if we run the driving 
pulse at a 1 GHz rate, it takes on average 0.1 ms to prepare the initial state. This time is 
comparable to the time that it takes for light to travel 100 km, which is on the same order 
of magnitude that we run our cyclic protocol in Fig. H^a). Considering a particular setup 
paramters, it is not then an obvious call to which of the DLCZ or SPS protocols performs 
better, and that underlines the importance of our theoretical analysis. 
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V. CONCLUSIONS 



In this paper, we analyzed the SPS protocol proposed in 17| in terms of the secret key 
generation rate that it could offer in a QKD-over-repeater setup. This protocol belongs to 
a family of probabilistic quantum repeaters, and perhaps one of their best, inspired by the 
DLCZ proposal 1(3] . Our aim was to compare the SPS protocol, for QKD applications, 



with the original DLCZ protocol, as reported in [11], in a realistic scenario. To this end, we 
considered various sources of imperfections in our analysis and obtained the optimal regime of 
operation as a function of system parameters. We accounted for double-photon probabilities 
at the source and realized that, under Shor-Preskill's security-proof assumptions, its value 
should not exceed 0.11/4, in a direct-link scenario, and 0.11/20 in a one-node repeater case. 
We would expect the same scaling, if not worse, at higher nesting levels, which implied that 
for a repeater setup of nesting level 3, the double-photon probability must be on the order 
of 10 -4 or lower. That would be a challenging requirement for on-demand single-photon 
sources needed in the SPS protocol. Under above circumstances, the advantage of the SPS 
protocol over the DLCZ would be marginal and would not exceed one order of magnitude 
of key rate in bit/s per memory. In our analysis, we also accounted for memory dephasing 
and dark counts. Our results showed that the minimum required coherence time for a link 
of length L is roughly given by 4L/c, where c is the speed of light in the channel. The 
crossover distance at which the repeater system outperforms the non-repeater one is about 
the same in both protocols, and it ranges from roughly 250 km to 400 km depending on the 
measurement efficiency among other parameters. We noticed that, within practical regimes 
of operation, there would only be a minor advantage in using resolving photodetectors over 
more conventional threshold detectors. We emphasized that, because of using a normalized 
figure of merit in our analysis, our results would be applicable to multi-memory and/or 
-mode scenarios. 
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Appendix A: Butterfly transformation 

In this Appendix, we find input-output relationships for the butterfly module in Fig. |6j 
We do this in the number-state representation, only for the relevant input states in Eq. (jSJ). 

Table HLT1 provides the output state for the butterfly operation B Vjnm when there is exactly 
one or two photons at one of the input ports. These are the only relevant terms in the input 
states in Eqs. ([3]) and (jlj). Using Table ULTl we find B VtVm (pf n ^) Cg> S )? ^ m (pr m ^), to be used in 
Eq. ©. 

The last operation required in Eq. (jSJ) is the symmetric butterfly operation B 5jVd . Table IA1 
lists the input-output relationships for all relevant input terms in our system for the more 
general operation B 5yVx . Note that by choosing r] x —rj s , we can use the same relationships 
for the measurement modules used in entanglement swapping and QKD of Figs. [2] and [3l 
respectively. For the sake of brevity, in Table [Al we have only included the terms that provide 
us with nonzero values after applying the measurement operation. More specifically, we have 
removed all asymmetric density matrix terms, such as |10)(01| or |01)(10| , for which the 
bra state is different from the ket state, from the output state. 
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TABLE IV. The input-output relationship for a symmetric butterfly module. The notation used 
is similar to that of Table IIIII 



Appendix B: Derivation of P c i; c k and P e rror 

In this Appendix, we find the gain and the QBER for the QKD scheme of Fig. [3J Let us 
assume that the memory pairs AB and CD are already entangled via the no- repeater or the 
one-node repeater scheme described in Sec. IIIII In the case of SPS protocol, their state is, 
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respectively, given by Eqs. flTJ) and (II ip . The density matrix right before photodetection in 
Fig. [3] is then given by pabcd = B , 5 , Vs (Bo.5, Vs (pab <8> Pcd)) , where one of the P-operators 
is applied to modes A and C, and the other one to modes B and D. Using Table \K\ we can 
calculate the exact form of Pabcd-, as we have done in this paper. 

The most general measurement on the modes entering the photodetectos of Fig. |3l namely, 
A, B, C, and D, can be written in terms of the following measurement operators: 

M abcd = \a) AA (a\ ® \b) BB (b\ <g> \c) cc (c\ <g> \d) DD {d\ (Bl) 

for PNRDs, where a, b, c, d = 0, 1 and \k)x represents a Fock state for the optical 
mode K — A, B, C, D. In the case of NRPDs, we only need to replace \1)kk (1| with 
(Ik — |0 )kk (0| ), where is the identity operator for mode K. 

Similarly, we can define the corresponding probabilities to the above measurement oper- 
ators as follows 

Pabcd = Tr (pABCDM abcd ) . (B2) 

The explicit forms for P c ii C k and P crr0 r are then given by 

Pclick Pc + Pe (B3) 

and 

Perror = e d P C + (1 - e d )P E , (B4) 

where e d is the dephasing (misalignment) error, and 



Pc= < 



(1 — g? c ) 2 (Plioo + Poo 11 + d c (Piooo + Poioo + -Pooio + -Poooi) + 2c^Poooo)> PNRD 
(f - 4 + l) (Pnoo + Poou) + 4(1 - f )(Piooi + Pouo) 
+ y(2 — 4)(-Piooo + -Poioo + -Pooio + Poooi) + %(2 — 4) 2 Pqi 



oooo 



+|(Pmo + Pnoi + Pom + Aon) + f (2 - 4)(Pioio + Pqioi) + 1^1111, NRPD 

(B5) 

is the probability that Alice and Bob assign identical bits to their raw keys if there is no 
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misalignment, and 



(1 — d c ) 2 (Piooi + Pono + ^c(-Pooo + -Poioo + -Pooio + -foooi) + 2g^P ooo); PNRD 
\~2 ~ + 1 j (-P1001 + -fono) + y(2 — d c ) (Piooq + Pnoo + -Pooio + Poooi) 
+^(2 — <i c ) 2 Poooo + f (-Pino + Plioi + Pom + Pmi) 
+f (2 - d B )(P 1100 + Pioio + Poon + Pom) + \Pmu NRPD 



(B6) 

is the probability that they make an erroneous bit assignment in the absence of misalignment. 
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